Answer:

The app.staging.securitytrax.com/sandbox URL will respond to an API request, but it’s going through a reverse proxy to api.staging.securitytrax.com. So when doing API requests, it’s better to use the api.staging URL.